Skip to content

Conversation

@jlebon
Copy link
Member

@jlebon jlebon commented Jan 27, 2025

As part of openshift/enhancements#1637, the CoreOS pipeline now only builds a RHEL-only RHCOS base image and later on, a node image is built on top of this base image to add all the OCP-specific packages.

As a result, the RHCOS release browser will only display the diff of the base image content, and will not have any OCP content.

Often, that's sufficient. E.g. if you're just interested in kernel or systemd changes, the RHCOS release browser is enough. However, users can be confused by the lack of OCP packages in the list.

Let's add an info box to the changelog page with instructions to generate a full diff. But only display it if one of the RHCOS versions is of the new RHEL-only kind.

As a bonus, these instructions also conveniently serve as a way to get any diff at all without VPN access.

Of course, being able to generate this diff ourselves and rendering it would be useful. And such a mechanism need not be specific to the CoreOS image; any of the many OCP images we ship which contain RPMs would benefit from being able to view package diffs.

The most likely candidate for implementing this would be in oc adm release info, but downloading images to generate diffs is a much more expensive operation than the git changelog-based one. So a caching service might be better instead.

(That said, it's possible with Konflux that we'll end up storing RPM lockfiles in git, in which case an RPM diff is a git diff which matches nicely the existing semantics.)


For a sample of what this looks like (forcing it on even though it wouldn't normally show in this case):

image

Just leave some more context for future git archeologists.
As part of openshift/enhancements#1637, the
version string for RHCOS will change from being OCP+RHEL-based (e.g.
419.96...) to being purely RHEL-based (e.g. 9.6...).

Adapt the logic for this new scheme so that it links to the right
stream.

We should eventually clean this up though so that the stream name is
available more directly to the release controller so that it doesn't
need to do any guessing.
Copy link
Collaborator

@bradmwilliams bradmwilliams left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes look good. Just one little nit. Go ahead and squash your commits and I'll approve.

As part of openshift/enhancements#1637, the
CoreOS pipeline now only builds a RHEL-only RHCOS base image and later
on, a node image is built on top of this base image to add all the
OCP-specific packages.

As a result, the RHCOS release browser will only display the diff of the
_base_ image content, and will not have any OCP content.

Often, that's sufficient. E.g. if you're just interested in kernel
or systemd changes, the RHCOS release browser is enough. However, users
can be confused by the lack of OCP packages in the list.

Let's add an info box to the changelog page with instructions to
generate a full diff. But only display it if one of the RHCOS versions
is of the new RHEL-only kind.

As a bonus, these instructions also conveniently serve as a way to get
any diff at all without VPN access.

Of course, being able to generate this diff ourselves and rendering it
would be useful. And such a mechanism need not be specific to the CoreOS
image; any of the many OCP images we ship which contain RPMs would
benefit from being able to view package diffs.

The most likely candidate for implementing this would be in
`oc adm release info`, but downloading images to generate diffs is a
much more expensive operation than the git changelog-based one. So a
caching service might be better instead.

(That said, it's possible with Konflux that we'll end up storing RPM
lockfiles in git, in which case an RPM diff _is_ a git diff which
matches nicely the existing semantics.)
@jlebon
Copy link
Member Author

jlebon commented Jan 27, 2025

Thanks, updated!

Go ahead and squash your commits

Hmm, each commit has a different rationale/message. I'd rather keep them all if possible. But if you'd really like, I can squash them and merge the commit messages.

@jlebon jlebon force-pushed the pr/layered-node-img branch from c66a3dd to 79a6133 Compare January 27, 2025 15:18
@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jan 27, 2025
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jan 27, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bradmwilliams, jlebon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 27, 2025
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jan 27, 2025

@jlebon: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/govulncheck 79a6133 link false /test govulncheck
ci/prow/security 79a6133 link false /test security

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-bot openshift-merge-bot bot merged commit f54fd2d into openshift:main Jan 27, 2025
4 of 6 checks passed
jlebon added a commit to jlebon/release-controller that referenced this pull request Jan 28, 2025
This basically fixes the gap that the infobox added in openshift#648 warns about.
Instead of relying on the CoreOS release browser differ, we directly
query for the diff using `oc adm release info`, which recently learned
to do this, and render it at the bottom of the page.

This removes the VPN requirement on being able to see the RPM diff.

In the case of the new layered node images, replace the diff link to
instead link to this new rendered section. We could in theory always
link to that, but let's be conservative. This provide a natural rollout
of the feature in case it needs ironing out.

Implementation-wise, we don't want to block the main changelog render on
getting the RPM diff. So we structure this the same way as the changelog
render itself; if the `oc` command takes too long, we display a nice
message to check again later. Once the command finishes and the output
is cached, we include it in the following render requests.
jlebon added a commit to jlebon/release-controller that referenced this pull request Jan 29, 2025
This basically fixes the gap that the infobox added in openshift#648 warns about.
Instead of relying on the CoreOS release browser differ, we directly
query for the diff using `oc adm release info`, which recently learned
to do this, and render it at the bottom of the page.

This removes the VPN requirement on being able to see the RPM diff.

In the case of the new layered node images, replace the diff link to
instead link to this new rendered section. We could in theory always
link to that, but let's be conservative. This provide a natural rollout
of the feature in case it needs ironing out.

Implementation-wise, we don't want to block the main changelog render on
getting the RPM diff. So we structure this the same way as the changelog
render itself; if the `oc` command takes too long, we display a nice
message to check again later. Once the command finishes and the output
is cached, we include it in the following render requests.
jlebon added a commit to jlebon/release-controller that referenced this pull request Feb 24, 2025
This basically fixes the gap that the infobox added in openshift#648 warns about.
Instead of relying on the CoreOS release browser differ, we directly
query for the diff using `oc adm release info`, which recently learned
to do this, and render it at the bottom of the page. The `diff` link now
simply links to that section of the page.

This removes the VPN requirement on being able to see the RPM diff.

Only do this for the new layered node images, as well as for 4.19.
We could in theory do this all the way back to e.g. 4.12 when RHCOS
switched to "OSTree native containers", but let's be conservative. This
provide a natural rollout of the feature in case it needs ironing out.

Implementation-wise, we don't want to block the main changelog render on
getting the RPM diff. So we structure this the same way as the changelog
render itself; if the `oc` command takes too long, we display a nice
message to check again later. Once the command finishes and the output
is cached, we include it in the following render requests.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants